8ac4b729edd105570d27086310152f4dc22d001b00dba6677fc188bfa65f8c3b

Analysis

max time kernel
114s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 21:29

Target

8ac4b729edd105570d27086310152f4dc22d001b00dba6677fc188bfa65f8c3b.dll
Size

2.0MB
MD5

354a53f155e8f16684ca2852243f71fb
SHA1

ce53f5f8cc5fe3ff848dc4bd66267ee23fc6fd59
SHA256

8ac4b729edd105570d27086310152f4dc22d001b00dba6677fc188bfa65f8c3b
SHA512

2968215a4f45deda26b32c6304663a0357ca11dc9e0afd3ab64008d5c40ff053208d863a47aab9d41c23c865cc7c24de915aee79ddf0f294078c174c2005463c
SSDEEP

49152:SpW2WCN9mIFOKjQ5TwconUr1q7NWcPjHzhtbC5GMhE:SpW2WCDmIFOh5Tw2q7NWsTh

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3260	2864	WerFault.exe	90
2020	2864	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2864	1848	rundll32.exe	90
PID 1848 wrote to memory of 2864	1848	rundll32.exe	90
PID 1848 wrote to memory of 2864	1848	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ac4b729edd105570d27086310152f4dc22d001b00dba6677fc188bfa65f8c3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ac4b729edd105570d27086310152f4dc22d001b00dba6677fc188bfa65f8c3b.dll,#1
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 620
    3⤵
    - Program crash
    PID:3260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 836
    3⤵
    - Program crash
    PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2864 -ip 2864
1⤵
PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2864 -ip 2864
1⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:1336